CLAIMS 

Amend the claims as follows. 

1 . (Currently Amended) A method, comprising: 

obtaining a signature by readin g executable code comprising a partial section of a 
steganographic program, wherein the steganographic program is configured to introduce 
steganographic items into a computer file; 

comparing the signature with one or more computer files; and 

displaying a listing of which of the one or more computer files provide a match with the 
signature. 

2. (Previously Presented) The method according to Claim 1 , wherein the listing 
includes an identification of the steganographic items location in a computer system. 

3. (Cancelled) 

4. (Currentiy Amended) The method according to Claim 1, wherein th e executable 
code comprises a dynamic link library (DLL) a.DLL file. 

5. (Previously Presented) The method according to Claim 1 , wherein an asserted file 

t3^e is ignored when comparing the one or more computer files with the signature. 

6. (Previously Presented) The method according to Claim 1, fiuther comprising: 
checking a respective real file type by reading a start of the one or more computer files; 

and 

excluding files having prearranged initial byte sequences fi-om the comparison. 

7. (Previously Presented) The method according to Claim 1 , wherein files not 
accessible by a system administrator are excluded fi-om the comparison. 
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8. (Previously Presented) The method according to Claim 1 , wherein the one or 

more computer files comprise deleted files. 

9. (Previously Presented) The method according to Claim 1, wherein the one or 
more computer files comprise self-extracting executable files. 

10. (Previously Presented) The method according to Claim 1, wherein some 
prearranged files are not identified in the listing despite containing code which matches the 

signature. 

1 1 . (Currently Amended) A computer apparatus comprising a storage device for 
storing one or more files, wherein the computer apparatus is configured to: 

obtain a signature by reading a partial section o f executable code of a program, wherein 
the program is configured to introduce steganographic items into a computer file; 

compare the signature with the one or more files stored on the storage device; and 
when a match with the signature is foimd, indicate which of the one or more files provide 
the match. 

12. (Previously Presented) The apparatus according to Claim 11, wherein the 
indication incorporates an identification of the matching signature. 

13. (Cancelled) 

14. (Currently Amended) The apparatus according to Claim 1 1 , wherein th e cod e of 
the signature comprises a continuous sequence of the partial section of th e executable code[[;]]. 

1 5. (Previously Presented) The apparatus according to Claim 1 1 , wherein one or more 
predetermined file types are not compared with the signature. 
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16. (Currently Amended) The apparatus according to Claim 11, wherein the partial 
section o f the executable code comprises a start of the computer file, and wherein files having 
prearranged initial byte sequences are excluded from the comparison. 

1 7 . (Previously Presented) The apparatus according to Claim 1 1 , wherein files not 
accessible by a system administrator are excluded from the comparison. 

1 8. (Previously Presented) The apparatus according to Claim 1 1 , wherein the one or 

more files comprise logical wastebasket files. 

19. (Previously Presented) The apparatus according to Claim 1 1, wherein the one or 
more files comprise polymorphic files. 

20. (Cvirrently Amended) The apparatus according to Claim 1 1, wherein one or more 
predetermined files are not indicated despite containing code which matches the [[a]] signature. 

21. (Cancelled) 

22. (Currently Amended) The computer readable medium according to Claim 3 1 , 
wherein the operations furthe r comprise comprising identifying a steganographic item 
responsible for the match. 

23. (Cancelled) 

24. (Currently Amended) The computer readable medium according to Claim 3 1 , 
wherein the signature comprises a contmuous sequence o f executable program code but not more 
than 5% and not less than 0.167% of the program. 

25. (Previously Presented) The computer readable medium according to Claim 31, 
wherein an asserted file type is not compared with the signature. 
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26. (Currently Amended) The computer readable medium according to Claim 31, 
wherein th e operations metho 4 furthe r comprise comprises : 

checking a real file type by reading a start of the one or more files; and 
excluding files having prearranged initial byte sequences from the comparison. 

27. (Previously Presented) The computer readable medium according to Claim 3 1 , 
wherein files that are not accessible by a system administrator are excluded fi-om the comparison. 

28. (Previously Presented) The computer readable medium according to Claim 31, 
wherein the one or more files comprise logical wastebasket files. 

29. (Previously Presented) The computer readable medium according to Claim 3 1 , 
wherein the one or more files comprise self-extracting files. 

30. (Currently Amended) The computer readable medium according to Claim 3 1 , 
wherein the operations furthe r comprise comprising displajang the file which provides the 
match, and wherein files associated with certain file types are not displayed despite containing 
code which matches the signature. 

3 1 . (Currently Amended) A tangible computer readable medium having stored therein 
computer readable instructions that in response to execution if ex e cuted by a system, cause the 
system to perform operations a method comprising: 

obtaining a signature by readin g exectuable code comprising part of a program capable of 
introducing steganographic items; 

comparing the signature with one or more files; and 
identifying a file which provides _a fee match. 

32. (Currently Amended) The computer readable medium according to claim 3 1 , 

wherein the operations method furthe r comp rise co m pri s es executing the one or more files, and 
wherein the comparison is made prior to executing the one or more files. 
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33. (Previously Presented) The method according to claim 1, fUrther comprising 

running a virus checking program while comparing the signature with the one or more computer 
files. 

34. (Previously Presented) The apparatus according to claim 15, wherein the one or 
more predetermined file types comprise a graphic editor. 



35. (Cancelled) 
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